Google Cloud Speech-to-Text vs Smallest.ai Pulse STT

Google Cloud Speech-to-Text 25

The newest release note is still 2025-11-13, Chirp 3 preview in four more regions (page last updated 26 October 2026), 353 days ago (0). In the 90 days from 3 August we counted no release note and one Python client release, google-cloud-speech 2.41.0 on 1 October, whose only change is declaring Python 3.15 support. A release that doesn't change the service counts half on the 90-day line and can't set the recency line, so neither line moves (0). The last client release that touched the API was 2.37.0 on 26 February 2026 (endpointing sensitivity for streaming). Release notes, a public issue tracker and paid support (10). Official client libraries in seven or more languages (10). Package CI not checked (5). 0 + 0 + 10 + 10 + 5 = 25.

Smallest.ai Pulse STT 73

Read as a model. The newest Pulse changelog entry is dated 2 November 2026 (updated Indic benchmarks), and Pulse 2.0 launched within the period (30). Dated Pulse entries on 30 August, 18, 29 and 30 September, 1, 12, 13 and 21 October and 2 November (20). Public changelog, email support and a Discord server, with no evidence read of how they answer (10 of 15). The Python SDK smallestai 5.14.0 dates from 7 October with 12 releases since 9 August, but the npm Node SDK has not been published since May 2025 (8 of 15). The Python SDK repository runs CI and release workflows, but has no licence file (5 of 10). Total 73.

Google Cloud Speech-to-Text 85

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. OAuth 2.0 with service accounts and IAM roles, scoped per project, no API key in the documented V2 flow. The token can also travel in the URL. Google's OAuth guide accepts it as an access_token query parameter, the V2 discovery document (revision 20261001) lists access_token, oauth_token and key as query parameters, and on 1 November speech.googleapis.com/v2/projects/example-project/locations/global/recognizers answered 401 "missing required authentication credential" with no token and 401 "invalid authentication credentials" with a made-up ?access_token=, so the token is read from the query string. That takes the 10-point deduction, as every Google API listing does in this run (Gmail, Sheets, Drive and Calendar on 17 October, Ads, Model Armor, Secret Manager and Document AI on 1 November) (20). Audio isn't used for training unless the project opts in to data logging (20). Streaming and sync audio is processed in memory and not stored, and batch results are kept for a short window (15). Cloud Audit Logs cover Google Cloud APIs, though we didn't confirm which Speech methods they record (10). Valid security.txt, Google's vulnerability reward programme, SOC 2 and ISO 27001, and public Cloud security bulletins (20). 20 + 20 + 15 + 10 + 20 = 85.

Smallest.ai Pulse STT 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Google Cloud Speech-to-Text 20

No x402, MPP or L402 (0). Per-minute prices with volume tiers published without a login (20). The 60 free V1 minutes and the $300 new-account credit both need a billing account with a card (0). A person signs up in a browser (0).

Smallest.ai Pulse STT 40

No x402, MPP or L402 (0). Per-minute prices for each Pulse model published without a login, with two figures for Pulse Pro (20). Pay as you go starts with $10 of trial credits, which the terms also describe, and no page says a card is needed to claim them, read as inworld-tts's free plan was (20). A person signs up in a browser at app.smallest.ai and creates the key in the dashboard, and top-ups go to a card on file (0). Total 40.

Google Cloud Speech-to-Text 87

Closed service under the Google Cloud terms (15). The data logging page, the terms and the privacy notice agree that audio isn't used for training without opt-in, and a data processing addendum and sub-processor list exist (25). Google Cloud's terms carry a notice period before a GA capability is discontinued, but we found no dated Speech-to-Text deprecation notices (15). us and eu multi-region endpoints and a public sub-processor list (20).

Smallest.ai Pulse STT 71

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration targets, deprecated routes return a Deprecation: true header, and the 30 September changelog removed 14 European codes from the batch enum with a migration to multi-eu. The terms still let Smallest change or discontinue services at any time without notice (15 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 55.

Google Cloud Speech-to-Text 75

Google Cloud status page with a per-product history (20). One incident lists Speech-to-Text in the 90 days from 3 August, the europe-west2 incident of 20 October, 06:00 to 12:08 UTC, which named 38 products in that one region. A single-region incident is partial and read as minor, as this run reads partial incidents. The other three Google Cloud incidents since 3 August (20 August, 1 September, 8 and 9 October) don't list Speech-to-Text. The public page only shows broad incidents. Minor only (20). Quotas published with numbers, 300 concurrent streams, 300 sync and 150 batch requests a minute per region, streams up to 5 minutes and sync up to 1 minute (15). The Speech quotas page (last updated 26 October 2026) still says nothing about the error a quota breach returns or how to back off, and we don't count Google's general API design guide for this API (0). Speech-to-Text SLA of 99.9 per cent monthly uptime with credits of 10 to 50 per cent, per the 1 October check, not re-read on 1 November (10). Chirp 3 GA since 2025-10-13 in us and eu, though 82 of its 111 locales were preview on 1 October (10). 20 + 20 + 15 + 0 + 10 + 10 = 75.

Smallest.ai Pulse STT 63

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Standard plan limits published per model, 100 concurrent streaming sessions and 25 batch requests a minute, and the pricing page also says 100 concurrent STT streams (15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and batch calls are synchronous with optional webhooks (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms published, and the terms disclaim any availability commitment (5 of 10). Pulse, Pulse 2.0 and Pulse Pro carry no preview label, but eleven language codes are marked Beta (8 of 10). 20 + 0 + 15 + 15 + 5 + 8 = 63.

Google Cloud Speech-to-Text 80

The API surface is public as protocol buffers and a discovery document, a machine-readable contract (25). No llms.txt found (0). Method descriptions state purpose, and the model pages say which model suits which audio, but not when to avoid sync or streaming (15). Typed proto messages with enums and required fields, no free-form blobs (15). Errors follow Google's standard status codes, with samples in the docs but little per-method error detail (10). Versioned v1 and v2 with release notes (15). The V2 discovery document read on 1 November is revision 20261001, with 26 methods and 69 schemas.

Smallest.ai Pulse STT 92

OpenAPI 3.1 for the HTTP routes and AsyncAPI 2.6 for the STT socket, with query parameters and event schemas (25). llms.txt and a Markdown copy of every page (10). Model cards and a compare page say which model suits which audio, and fields say where they're ignored (Pulse Pro ignores redaction), but several changelog entries correct response fields the reference had wrong, such as the diarisation shape and a redacted_entities array that doesn't exist (15 of 20). Typed query parameters with enums, defaults and required marks, though booleans are string enums that must be lowercase (13 of 15). Examples in curl, Python and JavaScript, and the reference lists 400, 401, 403, 413, 422 and 429 bodies with known code values (14 of 15). Versioned /v1 paths, a deprecations page and a dated Pulse changelog (15). Total 92.